This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 77547e0310 Fixed: Do not evaluate a request parameter as an expression
in the return-user-message from-field (OFBIZ-13640)
77547e0310 is described below
commit 77547e0310b7e1b921925b6d24df494082df4d77
Author: Mridul Pathak <[email protected]>
AuthorDate: Sat Oct 3 23:15:46 2026 +0530
Fixed: Do not evaluate a request parameter as an expression in the
return-user-message from-field (OFBIZ-13640)
With return-user-message from-field in a controller,
RequestHandler.setUserMessageResponseToRequest looked the field up in the
combined map of the request, where the request parameters are the fallback when
no attribute with that name exists, and evaluated the value as a
FlexibleStringExpander, so a request parameter with the name of the field was
evaluated as an expression, while a message that comes from the request through
_CUSTOM_ERROR_MESSAGE_ or _CUSTOM_EVENT_MESSAGE_ is deliber [...]
The field is now read from the request attributes only, which is where the
results of events and services are, so request parameters are never evaluated,
and the documentation of from-field in site-conf.xsd says so. No controller
delivered with OFBiz uses return-user-message.
(cherry picked from commit 9914b0c96ce5a1906ebcfb33972d574beb202743)
---
framework/webapp/dtd/site-conf.xsd | 3 ++-
.../org/apache/ofbiz/webapp/control/RequestHandler.java | 16 +++++++++-------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/framework/webapp/dtd/site-conf.xsd
b/framework/webapp/dtd/site-conf.xsd
index b3258b3cce..6e2b57e901 100644
--- a/framework/webapp/dtd/site-conf.xsd
+++ b/framework/webapp/dtd/site-conf.xsd
@@ -410,7 +410,8 @@ under the License.
<xs:attribute name="from-field" type="xs:string">
<xs:annotation>
<xs:documentation>
- Set from what field in context we can found the
response user message. This field can contain a flexible string
+ Set from what request attribute (for example set by an
event or a service) we can found the response user message.
+ This attribute can contain a flexible string, a
request parameter is never used
</xs:documentation>
</xs:annotation>
</xs:attribute>
diff --git
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
index aee64c8ce8..9d75b3122b 100644
---
a/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
+++
b/framework/webapp/src/main/java/org/apache/ofbiz/webapp/control/RequestHandler.java
@@ -1090,13 +1090,15 @@ public final class RequestHandler {
responseMessage.getRessource(), value,
context, UtilHttp.getLocale(request))
: value;
- } else if (responseMessage.getFromField() != null
- && context.containsKey(responseMessage.getFromField())) {
-
- // now analyze each field to found a flexible string to expand
- userMessage = FlexibleStringExpander.getInstance(
- (String)
context.get(responseMessage.getFromField()))
- .expandString(context);
+ } else if (responseMessage.getFromField() != null) {
+
+ // The message is looked up in the request attributes only,
where events and services put their results, and not in
+ // the request parameters, so that what the client sends is
never evaluated as an expression.
+ Object fieldValue =
request.getAttribute(responseMessage.getFromField());
+ if (fieldValue instanceof String) {
+ // now analyze the field to found a flexible string to
expand
+ userMessage = FlexibleStringExpander.getInstance((String)
fieldValue).expandString(context);
+ }
}
if (UtilValidate.isNotEmpty(userMessage)) {
